Right to not be subject of individualised decisions
The last of the GDPR rights that the Regulation grants you is the right to not be subject of decisions based solely on automated processing which produces you legal effects or affects you similarly.
And the same applies to the processing of your personal data with the purpose of profiling, which covers those situations where aspects of you are analysed in order to predict your behaviour.
Notwithstanding the above, the controller entity or organisation may still take automated decisions where:
- it is necessary for entering into, or performance of, a contract between you and the entity; or
- you have given explicit consent.
In both cases, the GDPR requires the organisation to implement suitable measures to safeguard your rights and freedoms and legitimate interests and, at least the right to obtain human intervention, to express your point of view and to contest the decision.
Automated individualised decisions or profiling may also be taken lawfully where it is authorised by Union or Member State law, provided these regulations lay down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests.
Finally, companies which wish to take automated individualised decisions based on special categories of personal data (gdpr sensitive personal data) need to ask for your explicit consent or to have a public interest ground and to adopt suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests.